On September 1, 2026, offensive security engineer Francisco Rosales from Manifold Security published research on GitSpawn: coding CLI agents gather repository context via git at session start and do not sanitize the repository's own settings. Due to the core.fsmonitor setting in .git/config, a malicious repository that lands on disk as files executes its code on the host before any trust prompt, outside the sandbox and bypassing the permission model. The researcher counted 8 findings in 7 tools; some vendors have already released patches, but four findings remain unpatched.

image

What happened

Francisco Rosales tested one common primitive across seven CLI agents and obtained eight findings. The mechanism is simple: core.fsmonitor in .git/config sets the name of a command that git itself runs when updating the index in git status and git diff. Agents run such commands to gather context at session start, so a repository that lands on disk as files via an archive, shared folder, or USB, rather than through git clone, executes its code before any trust prompt, and on some agents before authentication or the first character of a prompt. Execution happens as a subprocess of the agent itself, meaning outside the sandbox and bypassing the permission model, and the attacker gains SSH keys, cloud credentials, and tokens from the environment. Some findings have already been closed: goose's defect is formalized as an official advisory GHSA-r5pp-p5r8-466r with CVE-2026-72718, a CVSS 7.0 rating, and a fix in version 1.44.0; Claude Code was patched in 2.1.196 after a report on June 26; and OpenAI Codex and Cursor closed their findings as duplicates and released patches. Four more findings remained unpatched at the time of publication.

Context

GitSpawn is not the first time this layer has broken in the same way: previously, the same class of issues was closed one by one, as evidenced by CVE-2026-45033 in GitHub Copilot CLI and CVE-2026-55607 in Claude Code, and the research materials also mention the reserved CVE-2026-71963. The author notes that such things are "found from multiple directions," but GitSpawn became the first explicit audit of a single primitive across multiple agents, i.e., a transition from individual bugs to a class. The class is broader than one key: the ultrareview branch contains a second, unnamed config key of the same type. For the threat model of agent products, this means the attack lives at the process level, not the model behavior level, so existing behavioral security evals do not cover this layer.

Why this matters for the industry

Agent CLI vendors need to make sanitizing git config in all background calls a hygiene minimum, for example running commands like git -c core.fsmonitor=false status. Until this becomes standard, trust becomes the main asset of agent platforms, and enterprise clients may already this week ask vendors about sanitization. Within a six-month horizon, sanitizer wrappers over git in agent frameworks are expected as a default, detectors for executable keys in .git/config in CI and security scanners, and the first explicit safe/untrusted open and sandbox-by-default modes in agent interfaces. Over a two-year horizon, the class may formalize into a separate threat model category called agent context ingestion, where sanitizing external configs becomes a mandatory requirement for any tool that automatically reads the user's environment, similar to dependency scanning.

Why this matters for users

If you run Claude Code, Codex, Cursor, Goose, Qwen Code, Grok Build, or Hermes, do not open repositories received as files via zip archive, shared folder, or flash drive with an agent without checking .git/config: any setting pointing to a program can execute it. Update to patched versions: Claude Code no lower than 2.1.196, Goose no lower than 1.44.0, and findings in Codex and Cursor are also closed. For the four agents without a patch, including Qwen Code, Grok Build, Claude Code in ultrareview mode, and Hermes Agent, manual checking of .git/config before opening a repository remains the only protection.

What is still unknown / limitations

Seven tools are a sample checked by the author, not the population of all CLI agents: the selection criteria from the materials do not follow, so generalizations about a class-wide error should be read as a conclusion based on the checked sample. The details of each of the eight cases are not visible from the summary, including which specific agents detonate before authentication. The status of the second config key in the ultrareview branch and the patch timelines for unpatched agents are unknown, and the state of updates should be rechecked in vendor advisories, as it may have changed after publication. Expectations about sanitizer wrappers, CI detectors, and safe open modes are interpretations, not established facts.

Sources

Author

Look at AI, editorial team